CVE-2026-112404

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In _decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently, Pillow does not verify that the required input row fits inside the row libtiff produced, while the strip path has this validation. Loading pixels from such a crafted TIFF can expose adjacent heap data in output pixels or crash the process. This issue is fixed in version 13.0.0.

• CWE-126

• https://github.com/python-pillow/Pillow/commit/1d4773e6cea0c4a2814e6d4cdc099bbcf56da6ce
• https://github.com/python-pillow/Pillow/releases/tag/13.0.0
• https://github.com/python-pillow/Pillow/security/advisories/GHSA-c6hw-5grf-ff96

Published

Oct 19, 2026

Last Modified

Oct 20, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1124A security flaw has been discovered in Yonyou KSOA 9.0. Affe…9.8
• CVE-2026-11240Insufficient validation of untrusted input in Loader in Goog…3.1
• CVE-2026-112400Pillow is a Python imaging library. From 9.2.0 until 13.0.0,…8.7
• CVE-2026-112401Pillow is a Python imaging library. From 5.4.0 until 13.0.0,…6.9
• CVE-2026-112402Pillow is a Python imaging library. Prior to 13.0.0, Pillow …8.7
• CVE-2026-112403Pillow is a Python imaging library. Prior to 13.0.0, Pillow'…9.2
• CVE-2026-112405Pillow is a Python imaging library. From 12.0.0 until 13.0.0…8.7
• CVE-2026-112406Pillow is a Python imaging library. From 5.1.0 until 13.0.0,…8.7
• CVE-2026-112407Incorrect privilege assignment in the IAM policy of AWS CICD…8.8
• CVE-2026-112408Missing verification of source of a communication channel in…8.1
• CVE-2026-11241Insufficient validation of untrusted input in Cast in Google…8
• CVE-2026-11242Insufficient validation of untrusted input in Plugins in Goo…7.5